Gestion d’entreprise · Internal Audit and GRC
The GRC layer on top of Compliance Control: an audit universe prioritized by risk, an annual plan approved by the committee, engagements with an audit program and reviewed working papers, findings with a management action plan and follow-up, three lines of defense declared, key risk indicators with risk appetite thresholds read from the real operating modules, and the ISO 27001, COSO and SOX libraries mapped onto the controls the company already has.
O problema e a saída
Se alguma dessas situações parece familiar, é porque elas se repetem em quase toda empresa de formatura, até o sistema certo entrar em cena.
Internal audit is a spreadsheet of loose findings, and nobody knows whether the annual plan was carried out.
An audit universe with risk by process, an annual plan that is versioned and approved, engagements with status and plan execution measured on the dashboard.
The finding is written down, the manager agrees in the meeting and six months later nothing has changed.
A finding with a recommendation, a management action plan, a deadline and an owner, turning into an action in the same remediation flow Compliance already uses, with automatic follow-up and overdue alerts.
The person testing the control belongs to the same area that performs the control.
Independence checked through the segregation of duties that already exists: an auditor does not run procedures over controls in their own area, and any exception has to be recorded.
The board asks for risk indicators and gets opinions painted in traffic-light colors.
Indicators calculated from named formulas in code, reading overdue receivables, chargebacks, serious incidents, turnover, accidents and critical nonconformities, with risk appetite and tolerance declared.
Certification asks for the Statement of Applicability, and it gets assembled by hand every time.
ISO 27001, COSO and SOX libraries loaded per company and mapped to the internal controls, with the statement generated from the matrix and an explicit exception for any item excluded without justification.
Na prática
Situações do dia a dia de empresas de formatura, do problema ao resultado, usando os módulos que você vê nesta página.
The company has to decide what to audit this year with the team it has.
The audit universe is scored for inherent risk by process and business unit. The plan is built from that prioritization, versioned and approved on the committee agenda.
The choice of what to audit is documented, and plan execution becomes a metric for the period.
The auditor has to prove what was tested, with the sample and the evidence.
The engagement has an audit program with procedures, working papers with the sample, attached evidence, a conclusion and review by someone else. A finding becomes an action with an owner and a deadline.
The report comes out with a complete trail, and follow-up chases on its own once the deadline passes.
Overdue receivables go past the limit the board accepted.
The daily measurement compares the value against appetite and tolerance. Out of range, continuous monitoring raises an alert and the board dashboard shows the trend.
The conversation in the meeting starts from the number and the time series, not from this month's impression.
Como funciona
Cada etapa é um módulo de verdade, e o que sai de uma entra na outra sem ninguém digitar de novo.
Módulo por módulo
7 módulos e 35 recursos nesta página, o mesmo cadastro de turma, formando e evento sustentando todos eles.
What can be audited, and what will be audited this year.
The test that happened, with the proof that it happened.
What was found turns into change, with a deadline.
Who performs, who monitors and who audits, declared.
Risk measured with data from the system itself.
The standard tied to the control you already have.
The snapshot that goes to the meeting, with its date and its source.
Compare os módulos e escolha a configuração que acompanha sua operação.